Hi @Poojitha try using "unset" in the country dropdown, so that whenever it is changed, the state dropdown will first reset before populating. E.g. in the country dropdown xml:   <change> <unset token="state"></unset> </change>     ... View more

Hi @varshini_3141 there is currently no way to do this out of the box. You'd need to use custom HTML/CSS, or place text boxes on the map in dashboard studio to show the static values. ... View more

Hi @JuanPerez are you able to provide some more detail here? Are you wanting to get the Splunk health status of indexers and the indexes they contain, or is it some other health status you want to monitor, e.g. based on metrics logs? ... View more

Hi @AliDodd the first thing to check is whether the scheduled searches are being skipped or failed. You can check this from the job manager or the splunk health dashboard. If so, check the errors in the search.log and scheduler.log files.  If you still can't find the issue, test the collect command is sending data correctly to the index using a quick makeresults command, e.g. (Assuming there is no problem sending a dummy event to your production index!) | makeresults | eval test="test" | collect index="ldap_ad"   ... View more

Hi @chrislkt  | tstats only searches the indexed fields in tsidx files. All fields searched with tstats must exist in the tsidx files. Most likely the field from one of the sides of your OR condition cannot be found within the time range specified, so tstats can't evaluate the OR condition properly because of the non-existent field, leading to 0 results.  To get around this, you can just append another tstats command to replace the other side of the OR condition, e.g.   | tstats count where index="my_index" eventOrigin="api" accountId="8674756857" | append [| tstats count where index="my_index" eventOrigin="api" serviceType="unmanaged"]   ... View more

Hi @fredclown yes it's possible to have the HF still retain the ability to search its own locally indexed data, you just need to set indexAndForward = true in its outputs.conf  e.g. [tcpout] defaultGroup = new_indexers [tcpout:new_indexers] server = new_indexer1:9997, new_indexer2:9997 indexAndForward = true Keep in mind that, depending on the size of the indexes stored locally, this could result in significantly more resource utilization on the HF, so thorough testing is highly recommended.  ... View more

Hi @SplunkerNoob  Assuming these are external URLs (not other dashboards/searches within Splunk), you can add the trusted domains to the drilldownUrlWhitelist setting in the web.conf file.  @SplunkerNoob wrote: I think it is working but unfortunately I get: The URL you clicked cannot open as it is invalid and might contain malicious code. Change the URL to a relative or absolute URL, such as /app/search/datasets or https://www.splunk.com. ... View more

1. Does the "card" index exist? 2. Is any data at all being ingested to that index? 3. Are there any parsing or connectivity issues in the _internal index? ... View more

Hi @silverKi  To classify logs into multiple indexes based on one sourcetype: props.conf: [test] TRANSFORMS-routing = bankRouting,cardRouting,errorRouting Note: -the plural form TRANSFORMS-routing instead of TRANSFORM-routing. transforms.conf: [bankRouting] REGEX = (?i)bank DEST_KEY = _MetaData:Index FORMAT = bank [cardRouting] REGEX = (?i)card DEST_KEY = _MetaData:Index FORMAT = card [errorRouting] REGEX = (?i)error DEST_KEY = _MetaData:Index FORMAT = error Note: -Use (?i) for case-insensitive matching -Change DEST_KEY to _MetaData:Index -FORMAT should be the exact index name outputs.conf: [tcpout] defaultGroup = defaultGroup [tcpout:defaultGroup] server = 192.168.111.153:9997 [tcpout-server://192.168.111.151:9997] index = card [tcpout-server://192.168.111.152:9997] index = error       ... View more

Or with JSON: { "type": "splunk.table", "dataSources": { "primary": "ds_5ds4f5" }, "title": "Device Inventory", "eventHandlers": [ { "type": "drilldown.customUrl", "options": { "url": "{{row.target_url}}", "newTab": true } } ] } ... View more

Hi @SplunkerNoob, first create a field in your search which contains the URLs, e.g.  ... | eval target_url=case( device_type=="type1", "https://device1.com", device_type=="type2", "https://device2.com", device_type=="type3", "https://device3.com", 1=1, "https://default.com" )   Then in your dashboard: <drilldown> <link target="_blank">{{row.target_url}}</link> </drilldown> ... View more

Hi @Gauri you can use "|eventstats" instead of "|stats" to keep the data in the pipeline for the later "|stats" command:     | eval totalResponseTime=round(requestTimeinSec*1000) | convert num("requestTimeinSec") | rangemap field="totalResponseTime" "totalResponseTime"=0-3000 | rename range as RangetotalResponseTime | eval totalResponseTimeabv3sec=round(requestTimeinSec*1000) | rangemap field="totalResponseTimeabv3sec" "totalResponseTimeabv3sec"=3001-60000 | rename range as RangetotalResponseTimeabv3sec | eval Product=case( (like(proxyUri,"URI1") AND like(methodName,"POST")) OR (like(proxyUri,"URI2") AND like(methodName,"GET")) OR (like(proxyUri,"URI3") AND like(methodName,"GET")), "ABC") | bin span=5m _time | stats count(totalResponseTime) as TotalTrans by Product URI methodName _time | eventstats sum(eval(RangetotalResponseTime="totalResponseTime")) as TS<3S by Product URI methodName | eventstats sum(eval(RangetotalResponseTimeabv3sec="totalResponseTimeabv3sec")) as TS>3S by Product URI methodName | eval SLI=case(Product="ABC", round('TS<3S'/TotalTrans*100,4)) | rename methodName AS Method | where (Product="ABC") and (SLI<99) | stats sum(TS>3S) as AvgImpact count(URI) as DataOutage by Product URI Method | fields Product URI Method TotalTrans SLI AvgImpact DataOutage | sort Product URI Method     ... View more

@kaede_oogami  はい、Splunkでソースタイプを設定する際のCHARSET(文字エンコーディング)オプションについて説明いたします。 Shift-JIS関連の文字エンコーディングには確かに複数の選択肢がありますが、主な違いは以下の通りです: 1. SHIFT-JIS: - 標準的なShift-JISエンコーディングです。 - JIS X 0208で定義された文字セットをカバーしています。 2. SJIS: - SHIFT-JISの別名として使われることが多いです。 - 多くの場合、SHIFT-JISと同じ意味で使用されます。 3. MS932: - Microsoftによる拡張Shift-JISエンコーディングです。 - SHIFT-JISを基にしていますが、追加の文字(NEC特殊文字、IBM拡張文字など)をサポートしています。 - Windowsで一般的に使用される日本語エンコーディングです。 4. CP932: - MS932の別名です。「Code Page 932」の略称です。 5. Windows-31J: - MS932のIANA登録名です。 - 技術的にはMS932と同じですが、より正式な名称として使用されることがあります。 実際の使用においては: - 標準的なShift-JIS文書の場合、SHIFT-JISまたはSJISを選択すれば問題ありません。 - Windows環境で作成された文書や、拡張文字を含む可能性がある場合は、MS932やWindows-31Jを選択するのが安全です。 Splunkがこれらの選択肢を提供しているのは、異なるシステムや環境から来るデータに対応するためです。適切なエンコーディングを選択することで、日本語テキストを正確に解析し、インデックスすることができます。 特定のデータソースに対してどのエンコーディングを選択すべきか迷う場合は、データの出所やそれを生成したシステムの特性を考慮して判断するのが良いでしょう。 ... View more

Hi @MediumToast  If you only specify netfw,index,site1_netfw, it will not apply to all events from sources that are configured to be sent to the netfw index. It will only apply to events with the exact key netfw. Also, SC4S does not support wildcards in the splunk_metadata.csv file, so each sourcetype must be explicitly defined. If you have multiple Cisco devices (or any other types) that you want to redirect to site1_netfw, you will need to list each one individually.  You could get around this by updating the compliance_meta_by_source.conf and compliance_meta_by_source.csv files, e.g. like this (please test) compliance_meta_by_source.conf:   filter f_netfw_sources { program("cisco_asa" type(string)) or program("cisco_ios" type(string)) or program("cisco_nexus" type(string)) or program("juniper_netscreen" type(string)) # Add other relevant network firewall source types here };   compliance_meta_by_source.csv   f_netfw_sources,.splunk.index,site1_netfw       ... View more

Hi @yuvaraj_m91 You can reference the required fields in your Splunk alert config using $name$ for the alert name and $result.field$ for other fields ... View more

Hey @isoscow not sure if ideal/best practice/current, but we created alerts which dump results to a csv file using "| outputcsv", which also run a script as part their alert actions. The script sends the data from the csv to the third party ticketing system. ... View more

Hi @LearningGuy , does the query return any results when you run it on the DB directly? select * from host_ip   Also noticed you have "os_type" in your query vs "ostype" in your lookup. Could be the issue 🙂    ... View more

Hi @pratrox could you please expand on the issue you are facing?  Are you using the Splunk Add-on for Microsoft Windows? What do you mean by "full logs are not loading"? Does it mean some WinEventLog events are missing in Splunk which are present on your server, or are the events partially missing/cut in half in Splunk? As a first step, check for any parsing issues from your Splunk _internal logs:  index=_internal splunk_server=* source=*splunkd.log* component IN (AggregatorMiningProcessor LineBreakingProcessor DateParserVerbose) (log_level=WARN OR log_level=ERROR) data_sourcetype=WinEventLog* ... View more

Hi @karthi2809 There could either be a network issue, some unknown routing rules, or there may be a timestamp parsing issue.  Unless you have some external network monitoring or logging when the connection drops/fails to reach the endpoint, it can be tricky to pinpoint the cause of HEC issues. Do you have any such logging in the downstream Anypoint system? So, to narrow down the issue, first check the Splunk _internal logs for any obvious timestamp parsing issues: index=_internal splunk_server=* source=*splunkd.log* component=DateParserVerbose data_sourcetype=<your sourcetype> If there are no obvious timestamp parsing issues returned, next check whether a single event from the missing time period has actually been indexed to Splunk. It could be that the timestamp extraction step has actually been bypassed, so the events have been indexed under a different timestamp, meaning they won't show up in your search. Search (using time period "All time") : index=yourindex sourcetype=yoursourcetype _raw="full raw event copied from Anypoint logs"   ... View more

Hi @Be_JAR  In your first screenshot, it looks like the k8s.pod.name field is already being extracted correctly? It seems to get extracted correctly when using this run-anywhere search using the payload you provided: | makeresults | eval _raw="{ \"deployment.environment\":\"entorno-pruebas\", \"k8s.cluster.name\":\"splunk-otel\", \"k8s.namespace.name\":\"default\", \"k8s.node.name\":\"minikube\", \"k8s.pod.name\":\"my-otel-demo-emailservice-fc5bc4c5f-jxzqz\", \"k8s.pod.uid\":\"5fe1ada8-8baa-4960-b873-381b475b2b26\", \"metric_type\":\"Gauge\", \"os.type\":\"linux\", \"metric_name:k8s.pod.filesystem.usage\":491520 }" | spath | stats values(k8s.pod.name) as k8s.pod.name   ... View more

Hi @sgabriel1962 ,  What changes did you make, and how did you deploy them? Did you deploy a bundle from your cluster manager? Try running this on cluster manager:  ./bin/splunk validate cluster-bundle ... View more

Hi @Poojitha following the example from the documentation on spath: https://docs.splunk.com/Documentation/Splunk/9.2.1/SearchReference/Spath#3:_Extract_and_expand_JSON_events_with_multi-valued_fields  Here is a runanywhere example: | makeresults | eval _raw="{ \"Tag\": [ {\"Key\": \"app\", \"Value\": \"test_value\"}, {\"Key\": \"key1\", \"Value\": \"value1\"}, {\"Key\": \"key2\", \"Value\": \"value2\"}, {\"Key\": \"email\", \"Value\": \"test@abc.com\"}, ] } " | spath | rename Tag{}.Key as key, Tag{}.Value as value | eval x=mvzip(key,value) | mvexpand x | eval x=split(x,",") | eval key=mvindex(x,0) | eval value=mvindex(x,1) | table _time key value   ... View more